3 ms·

I think the idea is that various Linux endpoint protection products don't look there.

• cyberCleve 5y ago
  That seems like an obvious oversight. This is a well known and widely used malware technique. https://attack.mitre.org/techniques/T1053/003/ https://attack.mitre.org/techniques/T1053/003/